/*
XPTracker - Alternative Agile Tracking Tool
Copyright (C) 2006-2009  Stephen Starkey

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
*/
package net.sourceforge.stripes.security.tag;

import net.sourceforge.stripes.security.controller.StripesSecurityManager;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.jsp.JspException;
import javax.servlet.jsp.tagext.TagSupport;
import java.util.Arrays;
import java.util.List;

import com.google.inject.Inject;

public class SecureTag extends TagSupport {
  private String roles;

  @Inject
  public static StripesSecurityManager securityManager;

  public SecureTag() {
    super();
    initValues();
  }

  public String getRoles() {
    return roles;
  }

  public void setRoles(String roles) {
    this.roles = roles;
  }

  public int doStartTag() throws JspException {
    if (roles == null || roles.length() < 1)
      return SKIP_BODY;

    List<String> anyRoles = Arrays.asList(roles.trim().split(","));
    if (securityManager.isUserInRole(anyRoles, ((HttpServletRequest) pageContext.getRequest()), ((HttpServletResponse) pageContext.getResponse())))
      return EVAL_BODY_INCLUDE;

    return SKIP_BODY;
  }

  private void initValues() {
    roles = "";
  }
}
